API Discovery: One Inventory of the APIs You Run

What It Does

Discovery answers a question most organizations cannot: which APIs do we actually run? It builds one inventory from the sources you connect: specification files and addresses, gateway exports and live gateways, Kubernetes routes, AI model gateways, MCP servers and agent cards, Postman and SwaggerHub, OpenTelemetry traces, Datadog, Splunk and Elastic records, access logs, HAR files and repositories. Source-code discovery reads routes from Express, Fastify, NestJS, Spring, ASP.NET Core, FastAPI, Flask, Django and Go projects as text, within caps on file count and size. It never compiles or runs your code, and you tick each source to allow it. APIs found in code show as inferred, with the file and line, until a specification or traffic agrees. A route whose method or path is computed is counted as not listed, with the reason, rather than guessed. Every row says how sure we are it exists, whether it has a specification, and whether it can be tested. The Review and Changes views show what is new, changed or missing, and drift compares APIs that are documented but never seen with APIs that are seen but undocumented, with the time window stated. Sources run when someone presses Run now or on a schedule, on the server or through an approved agent inside your network. You control retention, and you can Forget a source to erase what it read. In the desktop app, Scan for APIs looks at programs listening on your own computer after asking for your consent, and Capture its calls records one application in a Studio window. Discovery finds APIs that have no tests; it does not generate tests from traffic. APIs of kinds Shift-Left API does not test, such as messaging, are listed for visibility and cannot be accepted into a project.

Key Capabilities

How It Works

1. 1

   Add a source: a specification address or file, a gateway, a repository, a log or HAR file, or add an API by hand

2. 2

   Run it now or on a schedule, on the server or through an agent you approve inside your network

3. 3

   Read the Inventory: each row shows how sure we are it exists, its specification status and whether it is ready to test

4. 4

   Confirm or dismiss rows in the Review queue; a dismissal always carries a reason

5. 5

   Accept the APIs you want into a project; the normal importer creates the endpoints, no tests are created and nothing is sent